MetricBeat is Triggering Avoidable Credential Dumping False Positives

[gabriellandau]

MetricBeat uses gosigar for ProcMem and ProcArgs. Both of these calls request PROCESS_QUERY_LIMITED_INFORMATION | PROCESS_VM_READ which can trigger credential dumping false positives in third-party security software. We can avoid this problem with two simple changes, reducing SDH, customer headache, and vulnerabilities/blindspots created through customer exceptions in their security software. As a benefit, we'll be able to collect some data that we couldn't collect previously.

ProcMem::Get()

ProcMem::Get() requests PROCESS_QUERY_LIMITED_INFORMATION | PROCESS_VM_READ here. The handle is for GetProcessMemoryInfo. The docs for GetProcessMemoryInfo state that PROCESS_VM_READ is only needed for XP and Server 2003. Agent no longer supports either of those platforms, so let's stop requesting/requiring PROCESS_VM_READ.

Another important point is that we will never successfully acquire a PROCESS_VM_READ handle on any Protected Process or PPL, meaning this function will always fail on those processes. Since it's unnecessary for GetProcessMemoryInfo, then this function is failing needlessly on such processes. As a simple test for this, check whether you are getting memory information for services.exe which always runs as PPL.

ProcArgs::Get()

ProcArgs::Get() requests PROCESS_QUERY_LIMITED_INFORMATION | PROCESS_VM_READ here. lsass.exe never has a meaningful command line (screenshot below), so can we skip calling ProcArgs::Get() on lsass.exe?

Its PID can be found in the registry. We can query that value once and cache the value because it will never change until reboot. This LSA exclusion logic may be better put outside of gosigar itself.

C:\>reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LsaPid

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
    LsaPid    REG_DWORD    0x5ac

For confirmed bugs, please report:

• Version: 8.15.0
• Operating System: Windows

[elasticmachine]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[gabriellandau]

@andrewkroh said that go-sysinfo has similar code which can likely be improved: https://github.com/elastic/go-sysinfo/blob/323c852f7ef4e11d668f3eb99ecaf9c6baa967c9/providers/windows/process_windows.go#L266-L285

[cmacknz]

FYI @VihasMakwana since you have been addressing some of the other unnecessary sources of errors in the system module.

[VihasMakwana]

@gabriellandau
For process memory:
- metricbeat uses elastic-agent-system-metrics's custom implementation, not gosigar. See here.
- It only uses PROCESS_QUERY_LIMITED_INFORMATION and not PROCESS_VM_READ(thanks to this PR).

For process args:
- Again, metricbeat uses elastic-agent-system-metrics's custom implementation, not gosigar. See here.
- Additionally, due to recent changes, API calls that require PROCESS_VM_READ are no longer guaranteed to succeed (especially for protected processes, as you mentioned). As a result, we log any errors at the debug level and avoid propagating them to the caller.

[VihasMakwana]

We should probably update gosigar for handling the process memory without PROCESS_VM_READ.

But as far as metricbeat is concerned, I don't think we need to make any additional changes.

cc: @cmacknz

[cmacknz]

We should probably update gosigar for handling the process memory without PROCESS_VM_READ.

Makes sense to me. We still depend on gosigar so fixing it there will potentially save us from accidentally regressing on this somewhere else in the future.

[gabriellandau]

For process args:
- Again, metricbeat uses elastic-agent-system-metrics's custom implementation, not gosigar. See here.
- Additionally, due to recent changes, API calls that require PROCESS_VM_READ are no longer guaranteed to succeed (especially for protected processes, as you mentioned). As a result, we log any errors at the debug level and avoid propagating them to the caller.

Thanks for clarifying. So the original question remains:

lsass.exe never has a meaningful command line (screenshot below), so can we skip calling ProcArgs::Get() on lsass.exe?

[VihasMakwana]

elastic/elastic-agent-system-metrics#198 up for review.